Privacy policy

The short version

Crash Galaxy is a slot studio. This website is a showcase for the games we build — there are no accounts, no sign-up forms, no comments and no payments on it. We do not ask you for personal information, and we do not sell or share anything about you.

The only visitor data that exists is (1) whatever our hosting provider records to serve the page, (2) the request your browser makes to Google Fonts for the two typefaces this site uses, and (3) aggregate traffic statistics from Google Analytics — and that third one only if you have actively accepted it. Nothing analytics-related is loaded, and no analytics cookie is set, until you press Allow analytics.

One more thing is stored, but only in your own browser and only if you act: follow a Play on Stake button and this site keeps a cookie recording which play link you followed. It holds a link address, nothing about you, and it never leaves your browser except back to us. Details are under Links to Stake and other sites below.

Who we are

Crash Galaxy is an independent slot studio publishing games on the Stake Engine platform. We are the data controller for this website, and admin@crashgalaxy.com is the address for any question, request or complaint under this policy — including a request for our full registered details.

We are not Stake, and we do not operate a casino. Play, accounts, balances and any personal data attached to them live with the operator, not with us.

What this site collects

Server logs

The hosting provider that serves crashgalaxy.com records ordinary request data — IP address, time, the page requested, browser user-agent — as every web server does. These logs are used to deliver the site and to investigate abuse or outages, and are retained for a short period by that provider, acting as our processor, as part of its standard operation.

Google Fonts

The site loads two typefaces from Google Fonts. That request reaches Google's servers and exposes your IP address and browser to them in the process of delivering the font files. Google states it does not use these requests to build advertising profiles, but if you would rather no request left your browser at all, block the domains fonts.googleapis.com and fonts.gstatic.com — the site falls back to system fonts and stays fully usable.

Google Analytics

Only after you accept it, this site loads Google Analytics 4 to count visits and see which games people look at. It records things like pages viewed, approximate location, device and browser type, and referring site. GA4 does not log or store full IP addresses: your address is used in transit to derive a coarse location and is then dropped by Google.

Once accepted, Google Analytics sets cookies (_ga and _ga_<id>) to tell repeat visits from new ones. We configure it with Google Signals and ad-personalisation signals switched off, and advertising storage denied outright, so no profile is built for advertising and no remarketing audience is created. We upload no customer data to Google. Google processes this data as our processor — see Google's privacy policy and how Google uses Analytics data. Decline, and none of it happens; withdraw later, and the cookies are deleted.

What the analytics events record

Once accepted, we also record what you do on the page, so we can tell which games hold attention and which play buttons actually get used. Each event is a short name and a handful of labels — never free text you have typed, because there is nothing here to type into. What is measured:

• Play button clicks. Which button, on which page, pointing at which site (stake.us, stake.com, stake.eu or stake.mx), carrying which referral code if any, and how long you had been on the page. This is the measurement the site exists for: it tells us whether the pages are doing their job.
• Play buttons coming into view, so a click count has something to be a percentage of.
• Ordinary navigation — menu opens, lineup tiles, breadcrumbs, previous/next links, links to other sites, and the address and phone links in the footer.
• Reading signals — how far down a page you scrolled, which sections reached the screen, which screenshot tab you pressed, whether you scrolled a math table sideways.
• Display preferences — light or dark theme, and whether the viewport is phone, tablet or desktop sized.
• Script errors, capped at three per page, so a broken page can be found and fixed.
• A page summary — seconds on the page, furthest scroll, and how many play buttons were clicked. It is sent whenever you switch away from the tab, so a single visit can send it more than once.
• Your acceptance itself, recorded once as an event when you press Allow analytics, along with which page you were on.

Events that happen before you answer the banner are held in the page's memory — never written to storage, never sent anywhere — and are sent only if you then accept. Decline, or close the tab without answering, and they are discarded with the page. Nothing about the banner-answering moment reaches Google unless the answer is yes.

Declining is not recorded, here or anywhere — measuring how many people refuse would mean sending a message about someone who just said no. Withdrawing later sends nothing either: the switch stops analytics and deletes the cookies, and that is all it does.

What we never collect

• Names, email addresses or phone numbers — there is no form here to enter them into.
• Payment details. No transaction happens on this site.
• Gameplay history, balances or account data. That belongs to the operator you play with.
• Anything sold, rented or traded to third parties. We do not do that, at any price.

Links to Stake and other sites

The "Play on Stake.us" and "Play on Stake.com" buttons are referral links and we may be compensated for referred players: they carry a code that tells Stake the visit came from Crash Galaxy. Each Stake site has its own code, and it is written into the link itself — you can see it in the address before you follow it. The code identifies the studio, not you. Stake may give us aggregate reporting on referred traffic, such as counts of visits or sign-ups.

The "Play on Stake.eu" and "Play on Stake.mx" buttons are not referral links. No code has been issued to us for those sites, so those links carry none and we are not compensated for anyone who follows them; they are there because that is where our games run in those regions. Our own analytics still counts the click, exactly as it counts the others — that is a count on our side, and nothing about it is passed to Stake.

Once you follow one of those links you are on Stake's site, under Stake's terms and privacy policy, and whatever they collect is governed by their policy rather than this one. The same is true of any other external site we link to.

Your theme preference

Pressing the light/dark switch in the header stores your choice in this browser's local storage under cg-theme, so the page opens the way you left it. It is a setting you asked for, it never leaves your browser, and it is not analytics — it is written whether or not you accept analytics, and clearing site data removes it.

Two more entries are kept in that same local storage, on the same terms — written by the page, never sent anywhere, removed by clearing site data. cg-demo-cooldown:<game> notes the time a demo’s credits ran out, so the page can tell you straight away rather than after asking the server; cg-stake-site remembers which Stake site you last chose, so the play button can offer that one first instead of asking again every time.

The referral cookie

When — and only when — you click one of those buttons, this site writes a first-party cookie named cg_ref to your browser. Its value is the address of the link you followed — including its referral code, where that link has one — and it expires after 30 days. We use it to know which of our own pages and buttons send people to Stake. It contains no name, no email, no identifier for you, and no browsing history; it is set by crashgalaxy.com and is sent only to crashgalaxy.com. Nothing on this site reads it back today, and nothing is written until you click.

This cookie cannot follow you onto Stake. A website can only set cookies on its own domain, so nothing here places a cookie on any Stake site — a referral code travels in the link address itself, which is why a play button that is supposed to carry one and cannot refuses to open at all. Clearing cookies for crashgalaxy.com in your browser removes cg_ref and it will not come back until you click a play button again.

The demo cookie

The playable demos on this site hand each visitor a fixed pot of play credits, once. To know that the pot has already been handed out — so that reloading the page does not simply deal another one — the site sets a first-party cookie named cg_demo the first time you open a demo. Its value is a random identifier that means nothing outside this site and is tied to nothing about you: no name, no email, no account, no browsing history. It is HttpOnly, so no script on the page can read it, and it is set whether or not you accept analytics — without it the demos could not be offered at all. Clearing site data for crashgalaxy.com removes it.

Alongside it, when a demo’s credits are used up, the server records that the cooling-off period has started. That record is held in the server’s memory, not in a database, and is keyed by the cookie above and by a one-way hash of your network address, salted with a random value that is generated afresh each time the server starts and is never written down. Your address itself is not stored and the hash cannot be turned back into it; the salt disappears when the server restarts, and so does the record. It exists to stop one visitor drawing an unlimited supply of demo credits, and it is used for nothing else — not analytics, not advertising, not profiling. One consequence worth stating plainly: where several people share one network address, as in an office or on a mobile network, one person finishing the demo can start that period for the others.

Your choices and rights

Depending on where you live — the EU/UK under the GDPR, California under the CCPA/CPRA, and similar laws elsewhere — you have rights to access, correct, delete, or restrict the processing of personal data about you, and to object to it or complain to your regulator.

Because this site holds no account and asks for nothing, the practical answer to most requests is that we hold nothing to give you. If you believe otherwise, email admin@crashgalaxy.com and we will look and answer within 30 days. Our lawful basis for analytics is your consent, given by pressing Allow analytics; you can withdraw it above at any time, as easily as it was given. Server logs rest on our legitimate interest in delivering and defending the site. We honour Global Privacy Control and Do Not Track signals as an opt-out.

Age and responsible play

Our games are built for adults and this site is not directed at children. Depending on the jurisdiction, real-money and social-casino play carries a minimum age of 18 or 21. We do not knowingly collect information from anyone under those ages; if you believe a minor has provided information to us, write to admin@crashgalaxy.com and we will delete it.

Play for entertainment, set limits, and stop when it stops being fun. Free, confidential help is available at ncpgambling.org or by calling 1-800-GAMBLER.

Security and international transfers

The site is static and served over HTTPS. Where analytics is enabled, data is processed by Google, which may transfer it outside your country under its standard contractual clauses and additional safeguards.

Changes to this policy

If this policy changes, the effective date at the top changes with it and the updated version is published here. Material changes will be summarised at the top of the page.

Contact

admin@crashgalaxy.com